https://bugzilla.redhat.com/show_bug.cgi?id=1455566
Bug ID: 1455566
Summary: CVE-2014-9970 jasypt: Vulnerable to timing attack
against the password hash comparison
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, aileenc(a)redhat.com,
alazarot(a)redhat.com, bbaranow(a)redhat.com,
bmaxwell(a)redhat.com, bmcclain(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
csutherl(a)redhat.com, dandread(a)redhat.com,
darran.lofthouse(a)redhat.com, dblechte(a)redhat.com,
dosoudil(a)redhat.com, eedri(a)redhat.com,
etirelli(a)redhat.com, gvarsami(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jcoleman(a)redhat.com,
jshepherd(a)redhat.com, kconner(a)redhat.com,
kseifried(a)redhat.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com,
lpetrovi(a)redhat.com, mbaluch(a)redhat.com,
mgoldboi(a)redhat.com, michal.skrivanek(a)redhat.com,
mwinkler(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, pavelp(a)redhat.com,
pgier(a)redhat.com, psakar(a)redhat.com,
pslavice(a)redhat.com, psotirop(a)redhat.com,
puntogil(a)libero.it, rnetuka(a)redhat.com,
rrajasek(a)redhat.com, rsvoboda(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
sherold(a)redhat.com, tcunning(a)redhat.com,
tiwillia(a)redhat.com, tkirby(a)redhat.com,
twalsh(a)redhat.com, vtunka(a)redhat.com,
ydary(a)redhat.com, ykaul(a)redhat.com
It was found that jasypt before allows a timing attack against the password
hash comparison.
Upstream patch:
https://sourceforge.net/p/jasypt/code/668/
--
You are receiving this mail because:
You are on the CC list for the bug.